This Week in Privacy: Sep 28 - Oct 4, 2026

Big Tech faced significant legal and regulatory consequences this week, with Google hit by a massive €403 million fine from Ireland's data protection watchdog for violating EU privacy rules. From Alabama to New Mexico, courts are holding platforms accountable for deceptive practices and failures to protect users, particularly children.

Top Stories

[Google fined €403 million for location data violations](https://privacywire.org/google/ireland-s-data-protection-commission-fined-google-sep-2026-2)

Ireland's Data Protection Commission delivered one of its largest penalties against Google on September 28, imposing a €403 million fine for how the company processed users' location data between 2018 and 2020. The investigation focused on three specific features: Web & App Activity, Location History, and Location Accuracy. Regulators found that Google's handling of this sensitive information violated the EU's General Data Protection Regulation. The company now has six months to bring its location tracking practices into compliance with European privacy law. This enforcement action underscores how European regulators continue to scrutinize the collection and use of location data, one of the most revealing types of personal information companies gather.

[TikTok ordered to pay up to $300 million and implement teen safety measures](https://privacywire.org/tiktok/alabama-court-approved-a-consent-decree-requiring-sep-2026)

An Alabama court approved a major settlement on September 25 resolving allegations that TikTok misled the public about child safety and deliberately designed addictive features targeting young users. The consent decree requires TikTok to pay $100 million immediately to Alabama consumers, with staged payments totaling up to $300 million as other states join similar agreements. Beyond the financial penalties, TikTok must implement mandatory teen safety features including daily time limits, age verification requirements, and restrictions on personalized content for users under 18. This settlement represents a significant step in addressing concerns about social media platforms' impact on young users and could set a precedent for how other states approach similar cases.

[Meta found to have willfully deceived users about data protection](https://privacywire.org/facebook/mexico-court-is-determining-penalties-for-meta-oct-2026)

A New Mexico jury determined that Meta deliberately made false claims about protecting user data and preventing misinformation on Facebook, particularly during the Cambridge Analytica scandal when user information was sold to third parties for targeted political advertising ahead of the 2016 election. The court is currently calculating penalties under New Mexico's Unfair Practices Act, with the state seeking up to $40 billion while Meta argues for a cap of $3.5 billion. A decision is expected by October 20. The case highlights ongoing legal repercussions from one of the most significant privacy scandals in tech history, demonstrating that platforms continue to face accountability for past deceptions even years later.

In Brief

• Microsoft's official X account was hijacked on October 2 to promote a fraudulent cryptocurrency scheme called $Clippy, exposing the company's 13 million followers to a pump-and-dump scam.

• A federal judge allowed YouTubers to proceed with their lawsuit against ByteDance for allegedly scraping their videos from YouTube without authorization to train AI models, finding they demonstrated financial harm from lost advertising revenue.

• A judge dismissed antitrust lawsuits from Chegg and Penske Media against Google over AI-powered search features, ruling that publishers' expectations of search traffic don't constitute legally enforceable agreements.

• Plaintiffs are seeking final approval for a $68 million settlement with Google over allegations the company improperly recorded users through Assistant-enabled devices without proper consent.

The Big Picture

This week's events reveal a continuing pattern of accountability catching up with Big Tech's past practices. The massive financial penalties against Google and Meta demonstrate that regulators and courts are willing to impose substantial consequences for privacy violations and deceptive practices, even years after the fact. Meanwhile, the Alabama settlement with TikTok shows growing momentum around protecting young users, with courts demanding not just monetary payments but concrete design changes to make platforms safer for children. At the same time, new challenges are emerging around AI training data, as the ByteDance lawsuit illustrates how scraping content without permission creates legal and financial risks for companies building machine learning systems. The message is clear: platforms can no longer treat user data and safety as afterthoughts without facing serious legal and financial repercussions.